CVE-2026-71403

6.1 Moyenne

Publiée le 03/09/2026 à 17:17 · Modifiée le 18/09/2026 à 17:03 · Analysée par le NVD · Source : meissner@suse.de

Description

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1.

Traduire en français

Produits concernés

SUSE Rancher

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	meissner@suse.de	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N`
3.1	6.1 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/rancher/rancher/pull/56616 Issue TrackingPatch

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories